{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-129-request-fresh-client-events-before-reloading-a-tenant-attached-device-timeline/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-129-request-fresh-client-events-before-reloading-a-tenant-attached-device-timeline/", "slug": "dse-20260917-129-request-fresh-client-events-before-reloading-a-tenant-attached-device-timeline", "url": "https://update.dsesecurity.com/updates/dse-20260917-129-request-fresh-client-events-before-reloading-a-tenant-attached-device-timeline/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-129-request-fresh-client-events-before-reloading-a-tenant-attached-device-timeline.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-129-request-fresh-client-events-before-reloading-a-tenant-attached-device-timeline/" }, "title": "Request fresh client events before reloading a tenant-attached device timeline", "summary": "What is the difference between Sync and Refresh when investigating a tenant-attached device timeline?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:32:51+00:00", "modified_at": "2026-09-17T16:42:36+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 206, "potentially_affected": "Apply this workflow to the on-premises device event timeline surfaced in the Intune admin center through Configuration Manager tenant attach. Identify the target device and investigation period before collecting evidence.", "dse_recommendation": "DSE recommends recording the event window and collection action in the investigation notes.", "primary_source": { "name": "Use Microsoft Intune policies with tenant attached Configuration Manager devices - Microsoft Intune | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/intune/fundamentals/tenant-attach", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft states that the timeline initially shows the last 24 hours and that devices normally send events to the admin center once a day. Sync requests recent client data; Refresh reloads the page to display events already collected. Configuration Manager must have Endpoint analytics data collection enabled to expose this timeline. Microsoft Learn.

\n

Applicability

\n

Apply this workflow to the on-premises device event timeline surfaced in the Intune admin center through Configuration Manager tenant attach. Identify the target device and investigation period before collecting evidence.

\n

DSE recommendation

\n

DSE recommends recording the event window and collection action in the investigation notes. Request a synchronization when recent client activity is needed, then reload the view and check the returned event times. Review the selected time range, event levels and provider filters before deciding that an expected event is absent.

\n

Verification

\n

On an approved test device, compare the most recent displayed event before and after a collection request. Record the request time and the event timestamps that actually arrive. If the desired period remains missing, retain that evidence gap and investigate the collection path before using the timeline to rule out activity.

\n

Official references

\n

Microsoft Learn: Configure tenant attach to support endpoint security policies from Intune. Source reviewed September 17, 2026.

", "content_text": "Source facts\nMicrosoft states that the timeline initially shows the last 24 hours and that devices normally send events to the admin center once a day. Sync requests recent client data; Refresh reloads the page to display events already collected. Configuration Manager must have Endpoint analytics data collection enabled to expose this timeline. Microsoft Learn.\nApplicability\nApply this workflow to the on-premises device event timeline surfaced in the Intune admin center through Configuration Manager tenant attach. Identify the target device and investigation period before collecting evidence.\nDSE recommendation\nDSE recommends recording the event window and collection action in the investigation notes. Request a synchronization when recent client activity is needed, then reload the view and check the returned event times. Review the selected time range, event levels and provider filters before deciding that an expected event is absent.\nVerification\nOn an approved test device, compare the most recent displayed event before and after a collection request. Record the request time and the event timestamps that actually arrive. If the desired period remains missing, retain that evidence gap and investigate the collection path before using the timeline to rule out activity.\nOfficial references\nMicrosoft Learn: Configure tenant attach to support endpoint security policies from Intune. Source reviewed September 17, 2026.", "content_markdown": "## Source facts\n\nMicrosoft states that the timeline initially shows the last 24 hours and that devices normally send events to the admin center once a day. Sync requests recent client data; Refresh reloads the page to display events already collected. Configuration Manager must have Endpoint analytics data collection enabled to expose this timeline. [Microsoft Learn](https://learn.microsoft.com/en-us/intune/fundamentals/tenant-attach).\n\n## Applicability\n\nApply this workflow to the on-premises device event timeline surfaced in the Intune admin center through Configuration Manager tenant attach. Identify the target device and investigation period before collecting evidence.\n\n## DSE recommendation\n\nDSE recommends recording the event window and collection action in the investigation notes. Request a synchronization when recent client activity is needed, then reload the view and check the returned event times. Review the selected time range, event levels and provider filters before deciding that an expected event is absent.\n\n## Verification\n\nOn an approved test device, compare the most recent displayed event before and after a collection request. Record the request time and the event timestamps that actually arrive. If the desired period remains missing, retain that evidence gap and investigate the collection path before using the timeline to rule out activity.\n\n## Official references\n\n[Microsoft Learn: Configure tenant attach to support endpoint security policies from Intune](https://learn.microsoft.com/en-us/intune/fundamentals/tenant-attach). Source reviewed September 17, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-129-request-fresh-client-events-before-reloading-a-tenant-attached-device-timeline/", "url": "https://update.dsesecurity.com/updates/dse-20260917-129-request-fresh-client-events-before-reloading-a-tenant-attached-device-timeline/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-129-request-fresh-client-events-before-reloading-a-tenant-attached-device-timeline/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Request fresh client events before reloading a tenant-attached device timeline", "item": "https://update.dsesecurity.com/updates/dse-20260917-129-request-fresh-client-events-before-reloading-a-tenant-attached-device-timeline/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-129-request-fresh-client-events-before-reloading-a-tenant-attached-device-timeline/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-129-request-fresh-client-events-before-reloading-a-tenant-attached-device-timeline/", "url": "https://update.dsesecurity.com/updates/dse-20260917-129-request-fresh-client-events-before-reloading-a-tenant-attached-device-timeline/", "headline": "Request fresh client events before reloading a tenant-attached device timeline", "description": "What is the difference between Sync and Refresh when investigating a tenant-attached device timeline?", "abstract": "What is the difference between Sync and Refresh when investigating a tenant-attached device timeline?", "articleBody": "Source facts\nMicrosoft states that the timeline initially shows the last 24 hours and that devices normally send events to the admin center once a day. Sync requests recent client data; Refresh reloads the page to display events already collected. Configuration Manager must have Endpoint analytics data collection enabled to expose this timeline. Microsoft Learn.\nApplicability\nApply this workflow to the on-premises device event timeline surfaced in the Intune admin center through Configuration Manager tenant attach. Identify the target device and investigation period before collecting evidence.\nDSE recommendation\nDSE recommends recording the event window and collection action in the investigation notes. Request a synchronization when recent client activity is needed, then reload the view and check the returned event times. Review the selected time range, event levels and provider filters before deciding that an expected event is absent.\nVerification\nOn an approved test device, compare the most recent displayed event before and after a collection request. Record the request time and the event timestamps that actually arrive. If the desired period remains missing, retain that evidence gap and investigate the collection path before using the timeline to rule out activity.\nOfficial references\nMicrosoft Learn: Configure tenant attach to support endpoint security policies from Intune. Source reviewed September 17, 2026.", "datePublished": "2026-09-17T16:32:51+00:00", "dateModified": "2026-09-17T16:42:36+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-129-request-fresh-client-events-before-reloading-a-tenant-attached-device-timeline/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-129-request-fresh-client-events-before-reloading-a-tenant-attached-device-timeline/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Request fresh client events before reloading a tenant-attached device timeline" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 206, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Use Microsoft Intune policies with tenant attached Configuration Manager devices - Microsoft Intune | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/intune/fundamentals/tenant-attach" } } ] } }